3 ms·
Ultimately if your input is never expected to pass a semicolon, quotation, bracket, parentheses, or other special char I explicitly remove them from the user in
by zelon88 9y ago
Ultimately if your input is never expected to pass a semicolon, quotation, bracket, parentheses, or other special char I explicitly remove them from the user input. I also believe that using POST inputs is less of a temptation/invitation for injection. Sure anyone can send a crafted CuRL request but it's a lot less inviting than just plugging your injection into the address bar.
- plopz 9y agoThis doesn't really help when serving content into different formats, html, json, xml, etc. Because you have different rules for what are special chars depending on the format. Maybe one format doesn't work with single quotes while another does.